PT-2022-19865 · Western Digital · Wd Discovery

Aaron Lemieux · Published 2022-09-19 · Updated 2023-07-21 · CVE-2022-29835

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Western Digital WD Discovery versions prior to 4.4.396

Description The WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm, which is not collision-free. This weakness could be exploited by an attacker to create forged certificate signatures, potentially impacting the confidentiality of user content.

Recommendations For versions prior to 4.4.396, update to version 4.4.396 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive user content until the update is applied.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-328

Related Identifiers

CVE-2022-29835

Affected Products

Wd Discovery

References · 4

• https://osv.dev/vulnerability/CVE-2022-29835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29835 · Security Note
• https://westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396 · Vendor Advisory
• https://t.me/cibsecurity/50087 · Telegram Post